DDOS protection system PROJECT FOR Fahd T.

DDOS protection system should work by analyzing packages in real time via something like pf_ring or dpdk (turning traffic to dpdk via vrf or port mirror). System should anlyze packages an by various rules generate bgp flowspecs rules to stop these attacks on core router or upstreams. Also dpdk can work with forwarding all traffic to it so may be if attack cant be stopped via inspecting traffic and bgp flowspec rules it can drop it on curent system. Base can be taken from there: [login to view URL] DDOS protection should be from 2 parts: 1 part (protection against high volume attacks): from port mirror collect data (like netflow) in some fast database (like memcached or something like it) to be able fast operate data in part2. Collect total network and by each ip information to graphite, rrd or something like it and make actions what will be setuped in config. For example: if more then XX pps or bps or flows will arrive to some of own network ips it must generate correct BGP flowspec rules and announce them to core router and also via BGP announce that traffic for that ip should be turned to INLINE protection (part2). 2 part (application level INLINE protection): this part should use techniques about what i told to Fahd T. via chat. Third part will be for GUI Who will take this job must know networking, how attacks works, OSI, c/c++, firewalling bassis, understand how to stop attacks by analyzing packages snifing and so on